This is a Nuxt 3 module that integrates Cloudflare Turnstile, a privacy-focused CAPTCHA alternative. It provides a Vue component (`<NuxtTurnstile>`) for client-side rendering of the Turnstile widget, a composable (`useScriptCloudflareTurnstile`) for script loading via `@nuxt/scripts`, and a server-side utility (`verifyTurnstileToken`) for token validation in Nitro endpoints. The module automatically handles script injection, token refresh, and exposes a reset method. It also supports an optional validation endpoint at `/_turnstile/validate`. The architecture follows the standard Nuxt module pattern: `src/module.ts` registers components, composables, and server handlers. External dependencies include Cloudflare's Turnstile API, `@nuxt/scripts`, `@nuxt/kit`, `defu`, and `pathe`. The codebase is well-structured, typed, and includes end-to-end tests with Playwright.
Prosopo is a privacy-focused, self-hosted CAPTCHA alternative that provides multiple challenge types—image selection, puzzle (image jigsaw), proof-of-work, and frictionless (behavioral bot detection). The system comprises an Express-based provider API (with MongoDB and Redis for persistence and caching), a CLI for administrative tasks, client-side embeddable widgets (vanilla JS bundle, React/Angular/Vue/Svelte wrappers), and a suite of supporting libraries for cryptography, locale, datasets, and native Rust modules (JA4 TLS fingerprinting, Merkle tree acceleration, puzzle rendering). Bot detection is multi-layered: client-side behavioral data (mouse/keyboard/touch events, SIMD readings) is collected and server-side scored, combined with JA4 TLS fingerprint analysis, IP reputation (ipapi.is + MaxMind), DNS asymmetry detection, spam email heuristics, and custom decision machines per site key. The architecture is a monorepo with ~70 workspaces, leveraging Vite for bundling, Vitest for unit/integration tests, and Cypress for E2E visual regression testing. The provider enforces access policies (allow/block/restrict) via a Redis-backed rules engine and maintains usage counters for rate limiting. Asset sealing (AES-256-GCM) protects image CDN URLs, and puzzle difficulty is sampled with a CSPRNG-stratified ladder to frustrate solver calibration.
Buster is a browser extension that solves reCAPTCHA audio challenges using speech recognition. When users encounter a reCAPTCHA with an audio challenge, they can click the extension button to automatically transcribe and submit the solution. The extension supports multiple speech recognition services including Google Cloud Speech-to-Text, IBM Watson, Microsoft Azure, Wit.ai, and local options like Whisper and Gemini Nano. It also offers a companion client app that can simulate user interactions to improve success rates. Built with Vue.js/Vuetify and designed for cross-browser compatibility (Chrome, Edge, Firefox, Opera), the extension uses Manifest V3 where available and includes features like theme support, automatic updates, and contribution prompts.
CloakBrowser is a commercial stealth browser automation library that wraps Playwright (Python, JavaScript, .NET) with a custom patched Chromium binary. Its core purpose is to evade bot detection by spoofing browser fingerprints, providing human-like interaction (Bezier mouse moves, realistic typing with typos, smooth scrolling), and managing licensed binary downloads with cryptographic verification. The architecture is a multi-language SDK sharing identical logic across Python, TypeScript, and C#, with a common human interaction engine, proxy/GeoIP integration, and license enforcement via denial files and server validation. Key entry points are the `launch()` and `humanize()` APIs, CLI diagnostics (`info`, `login`, `install`), and the `cloakserve` CDP multiplexer. External dependencies include Playwright/Puppeteer, MaxMind GeoLite2 database, Ed25519 signature verification (BouncyCastle), and a license validation server. The codebase demonstrates high engineering discipline with extensive cross-language parity tests and security-conscious binary distribution, but carries drift risks from triple-language duplication and reliance on Playwright internal APIs.